Mozilla Foundation Security Advisory 2014-30

Use-after-free in TypeObject

Announced

March 18, 2014

Reporter

VUPEN

Impact

Critical

Products

Firefox, Firefox ESR, SeaMonkey, Thunderbird

Fixed in

Firefox 28

Firefox ESR 24.4

SeaMonkey 2.25

Thunderbird 24.4

Description

Security research firm VUPEN, via TippingPoint's Pwn2Own
contest, reported that memory pressure during Garbage Collection could lead to
memory corruption of TypeObjects in the JS engine, resulting in an exploitable
use-after-free condition.

In general this flaw cannot be exploited through email in the
Thunderbird and Seamonkey products because scripting is disabled, but is
potentially a risk in browser or browser-like contexts.